Re: [PATCH 06/11] update debian initramfs in deterministic mode

[Henning Schild <henning.schild@siemens.com>]

Am Wed, 11 Jan 2023 09:39:34 +0100
schrieb "Moessbauer, Felix (T CED INW-CN)"
<felix.moessbauer@siemens.com>:

> On Wed, 2023-01-11 at 09:23 +0100, Henning Schild wrote:
> > Am Wed, 11 Jan 2023 04:11:35 +0000
> > schrieb Felix Moessbauer <felix.moessbauer@siemens.com>:
> >  
> > > This patch exports the SOURCE_DATE_EPOCH variable in the image
> > > install
> > > task. By that, update-initramfs is switched into reproducible
> > > mode. Before this patch, each trigger of update-initramfs created
> > > a new non-deterministic version of the initramfs.
> > >
> > > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > > ---
> > >  meta/classes/image.bbclass | 7 +++++++
> > >  1 file changed, 7 insertions(+)
> > >
> > > diff --git a/meta/classes/image.bbclass
> > > b/meta/classes/image.bbclass
> > > index b86a428..c981c7a 100644
> > > --- a/meta/classes/image.bbclass
> > > +++ b/meta/classes/image.bbclass
> > > @@ -304,6 +304,13 @@ python() {
> > >  }
> > >
> > >
> > > +# make generation of initramfs reproducible
> > > +rootfs_install_pkgs_install_prepend() {
> > > +    if [ ! -z "${SOURCE_DATE_EPOCH}" ]; then
> > > +        export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}"
> > > +    fi
> > > +}  
> >
> > Why prepend and not put this right into the task? This will be hard
> > to
> > maintain.  
> 
> Yes, true. However, the rootfs_install_pkgs_install is shared across
> all rootfs, but we really only want to set the SOURCE_DATE_EPOCH
> variable for the final target image install. If we would add it
> globally, this would break SSTATE caching all over the place, as it
> would have influence on the sbuild chroots.
> 
> On the other side, we also cannot whitelist the variable as it
> internally changes the logic of many tools so that they run in
> deterministic mode. And we also have to rebuild parts that depend on
> the value of the variable.

makes sense, but this has to be commented in the code, maybe bits in
the commit message, but likely mostly in the code

Henning

> Felix
> 
> >
> > Henning
> >  
> > >  # here we call a command that should describe your whole build
> > > system, # this could be "git describe" or something similar.
> > >  # set ISAR_RELEASE_CMD to customize, or override do_mark_rootfs
> > > to do something  
> >  
>